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Abstract 

Social  Network  Analysis  (SNA)  is  essential  to  understand  how  information  flows  through  Social  Networks 
and  is  thought  to  be  strategic  for  making  sense  of  how  individuals/groups/organizations  work, 
collaborate,  co-operate,  grow  or  influence  others.  Defence  Research  and  Development  Canada  (DRDC) 
Valcartier  is  performing  research  activities  on  SNA.  The  initial  research  activities  were  focusing  on  SNA 
conducted  in  a  counter-insurgency  context  and  were  aiming  at  investigating  SNA  methods  and  tools  that 
could  augment  an  intelligence  analysis  capability.  In  the  spirit  of  the  Visualization  domain,  which  allows 
information/knowledge  to  be  derived  from  the  visual  representation  of  data/information;  visualization 
widgets  were  designed  and  grouped  under  the  term  Graph  Analyzer  to  assist  intelligence  analysts  in 
comprehending  and  interpreting  social  network  (SN)-related  data  (automatically  extracted).  The  Graph 
Analyzer  Widget  and  other  developed  widgets  exploit  the  graphical  rendering  of  information/knowledge 
(e.g.  graphs,  diagrams,  charts,  etc.)  which  are  the  visual  artefacts  representing  data,  illustrating 
relationships  and  patterns  among  data,  and  also  allow  analysis  and  comparisons  between  graphical 
representations  of  data  sets.  These  widgets  propose  interactive,  explanatory  and  tailored  visualizations 
to  support  sense-making.  They  combine  visual  representations  of  graph  diagrams  composed  of  nodes 
and  links  to  other  visual  representations  such  as  statistical  results,  lists  of  nodes,  geospatial  and 
temporal  aspects  or  the  semantic  meaning  of  links  based  on  a  SN  ontology. 

1  Introduction 

Would  they  be  in  Afghanistan,  Haiti,  Mali,  Darfur,  Sudan,  or  any  region  of  Arabian  Sea,  many  of 
the  Canadian  operations  require  to  be  conducted  in  cultures  drastically  different  from  what  our 
military  members  are  used  to.  Moreover,  given  the  reality  of  asymmetric  warfare,  the 
distinction  between  the  adversary  and  the  local  population  is  blurred.  Consequently,  there  is  a 
need  to  better  understand  such  cultures  but  also  how  the  locals  are  related  to  these 
adversaries.  Operations  taking  place  in  an  insurgency  context  have  to  acknowledge  that 
insurgents  mostly  originate  from  the  local  population  or  else  are  strongly  connected  to  it.  This  is 
one  of  the  main  differences  between  insurgents  and  terrorists  cells.  Indeed,  while  insurgent 
groups  can  be  tightly  connected  to  criminal  or  terrorist  networks  [Lonsdale,  2008],  their 
motivation  is  different  as  it  is  initially  a  political  one  expressed  through  oppositions  to  the 
government  in  place  or  any  instance  supporting  it.  In  this  military  context  and  from  an 
intelligence  perspective,  there  is  a  long  time  now  that  nothing  is  solely  red,  blue  or  white. 
Terminology  such  as  pink  and  grey  situational  awareness  (SA)  has  developed  as  its  own  type  of 
SA  [Gavriel,  2010].  As  an  indicator  of  such  an  interest  about  human  related  activities  during 
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operations,  the  field  of  cultural  intelligence  has  greatly  developed  along  with  the  ones  of 
human  terrain  or  human  geography  for  instance.  Cultural  intelligence  is  thus  considered  as  a 
force  multiplier  in  the  contemporary  operating  environment  [Spencer  and  Balasevicius,  2009], 
which  cannot  anymore  be  discarded. 

1.1  SNA  Research  Activities  for  the  Intelligence 

Identifying  the  social  and  cultural  aspects  as  a  foundation  to  enable  SA  for  the  Intelligence 
purpose  is  one  essential  element  expressed  by  many  instances  and  defence  organizations  [DoD, 
2008;  2011].  It  also  has  been  identified  that  tools  and  methods  to  take  the  social  or  cultural 
aspects  into  consideration  are  lacking  within  the  intelligence  function  [DoD,  2011;  Foster  and 
Biggerstaff,  2006].  Social  network  analysis  (SNA)  is  one  of  those  few  tools  or  techniques  that 
permit  to  encounter  the  social  and  cultural  perspectives  of  an  operation  [Ressler  2006,  Knoke 
2013]. 

While  SNA  tools  and  methods  are  more  and  more  employed,  it  is  only  recently  that  it  has  been 
considered  to  enhance  the  intelligence  capability  [Wheaton  and  Richey,  2014;  TNO,  2014; 
Barber  et  al.,  2009].  The  initial  attempts  of  using  SNA  techniques  in  a  military  context 
emphasized  merely  the  identification  and  neutralization  of  specific  adversaries.  The  practice 
has  evolved  recognizing  the  limitations  of  such  approaches.  Activities  converged  rather  toward 
an  increased  situational  awareness,  which  includes  the  socio-cultural  aspects  by  use  of  SNA. 
SNA  techniques  are  now  used  to  understand  the  structure  of  the  local  population,  how  the 
adversaries  are  related  to  it  or  else  to  other  types  of  covert  networks.  Most  of  the  time  the 
analyses  do  not  provide  a  response  but  more  accurate  questions  highlighting  the  important 
elements  of  the  situation  being  faced  and  that  should  be  taken  into  consideration.  It  is  through 
the  understanding  of  all  the  essential  components  of  a  situation  that  the  analyst  will  be  able  to 
rapidly  switch  from  one  point  of  pressure  to  another  more  efficient  one. 

It  is  with  regard  to  such  intelligence  capability  deficiency  that  Defence  Research  and 
Development  Canada  (DRDC)  has  engaged  in  research  activities  regarding  the  value  of  SNA  for 
the  intelligence  function  [Lecocq  et  al.,  2011;  Lavigne  et  al.,  2012;  Martineau  and  Lecocq,  2013; 
Lecocq  et  al.,  2013].  Initially,  the  efforts  were  on  the  counter-insurgency  (COIN)  context  in 
order  to  provide  a  focus  for  the  research  activities.  Nevertheless,  the  research  activities  and  the 
inspection  and  evaluation  of  SNA  techniques,  tools  and  methods  have  a  broader  scope  and  can 
be  applied  to  different  Intelligence  contexts.  The  research  along  with  its  prototype  aims  at 
covering  an  entire  SNA  capability  required  by  the  intelligence  function  to  increase  its 
understanding  of  a  specific  theatre  of  operation  or  a  situation  being  faced.  Such  a  capability 
covers  more  stages  than  the  sole  analysis  aspect  as  exposed  in  the  figure  below.  Depicted  in  the 
Figure  1,  these  additional  stages  include:  the  identification  of  the  Intelligence  issues  or 
requirements  to  be  fulfilled  (point  1);  the  collection  of  pertinent  data  for  the  subsequent 
required  analysis  along  with  their  structuration  and  storage  as  per  points  2  and  3;  the  adapted 
representation  of  a  specific  network  of  interest  (point  4);  finally  it  is  only  at  that  time  that 
analyses  per  se  can  be  performed  as  depicted  in  point  5.  Once  again,  the  analyses  results  don't 
stand  on  their  own;  they  need  to  be  set  back  into  a  context  of  significance  in  order  for  the 
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analyst  to  reach  some  level  of  sense-making,  which  is  depicted  in  the  same  point  5  as  well  as 
point  6  where  the  results  are  set  back  into  the  context  of  the  initial  question  of  point  1. 

Another  significant  characteristic  of  the  approach  is  its  dynamic  aspect.  Indeed,  the  collection 
of  pertinent  information  and  data  underlying  the  analysis  of  the  networks  is  performed  on  a 
regular  basis  either  from  structured  or  unstructured  data  sources.  This  implies  that  a  same 
analysis  performed  on  a  network  composed  of  social  entities  and  relation  of  the  same  types  will 
provide,  at  two  different  timing,  distinct  results  to  the  intelligence  analyst.  Just  like  the 
situation  will  evolve  its  analysis  will  also  do. 
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Figure  1  -  Approach  for  the  SNA  proof-of-concept  prototype 

SNA  Software  Prototype  Description 


For  exploration  purposes,  an  integrative  SNA  prototype  is  being  developed  in  the  same  line  of 
thought  as  other  authors  [Semenov  et  al.,  2011],  i.e.  and  as  explained  in  the  previous  section,  it 
exceeds  the  sole  analysis  of  SNs  as  pictured  in  Figure  1  and  Figure  2.  Indeed,  it  rather  supports  a 
SNA  capability  where  services  and  functionalities  cope  with: 
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•  the  identification  of  meaningful  data  for  the  specific  intelligence  requirement  for  information; 

•  the  automated  extraction  and  organization  of  data; 

•  the  selection  of  sub-networks  of  interest  to  be  analysed; 

•  the  analysis  of  social  networks;  and 

•  the  sense-making  brought  to  light  by  use  of  visualization  and  through  the  contextualization  of 
the  analyses  results. 

The  development  of  the  SNA  proof-of-concept  prototype  relies  on  and  extends  the  services 
portfolio  of  the  Intelligence  Science  and  Technology  Integration  Platform  (ISTIP).  Following 
service-oriented  architecture  (SOA)  design  principles,  the  ISTIP  provides  a  backbone  platform 
for  the  iterative  and  incremental  development  of  software  inside  DRDC  Valcartier  Command, 
Control  and  Intelligence  section.  The  ISTIP  provides  loosely  coupled,  reusable  and  composable 
services  as  foundations  to  intelligence  support  systems  involved  in  different  research  projects. 
For  example,  the  following  features  are  offered  on  the  platform: 

•  Automated  reasoning  of  different  kind  (rule-based,  case-based,  description  logic  etc.); 

•  Anomaly  detection; 

•  Visual  analytics; 

•  SNA; 

•  Ontology  management;  and 

•  Natural  language  processing. 

This  section  will  not  describe  all  the  features  but  rather  the  ones  directly  pertaining  to  the  SNA 
capability. 
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Graph  Analyzer 


2.1  Data  Extraction  Services 


In  order  to  present  visually  and  analyze  social  networks,  data  concerning  these  networks  need 
to  be  collected.  While  a  certain  amount  of  this  information  can  be  accessed  through  structured 
data  sources,  a  significant  quantity  of  information  is  usually  amassed  in  a  multitude  of 
unstructured  text  reports.  The  prototype  builds  this  capacity  using  services  based  on  work  done 
for  the  Multi-Intelligence  Tool  Suite  (MITS)  that  had  a  similar  capability  [Roy  and  Auger,  2011]. 
Depicted  in  Figure  2  under  the  point  "2a",  these  modules  extract  propositions  (facts)  in  an 
autonomous  manner  from  unstructured  text  documents.  Since  SN  data  can  be  expressed  in  the 
form  of  a  proposition  (fact),  the  SNA  capability  leverages  the  same  services  for  automatic 
extraction  of  SN  data,  which  are: 

•  the  Semantic  Annotation  of  Text  Documents  (SATD);  and 

•  the  Automatic  Fact  Extraction  from  Text  Documents  (AFEXTD). 

The  SATD  is  a  web  service  that  uses  ontologies  (Figure  2  point  "1")  to  produce  semantic 
annotations  of  text  documents  presented  to  it.  In  order  to  annotate  a  document,  the  SATD  uses 
one  or  more  domain  ontologies  like  terrorist  ontologies  or  else  SN  ontologies.  Documents  are 
fed  on  a  continuous  basis  via  a  data  source  crawling  service  that  scans  existing  databases  and 
returns  new  documents.  Then,  given  a  list  of  a  priory  known  instances  of  classes  residing  within 
the  ontology  (classes  like  people,  organizations,  or  events...),  as  well  as  instances  of  links  (links 
like  kinship,  affiliation  types,  etc.),  the  system  annotates  the  text  with  these  instances.  The 
obtained  annotations  are  subsequently  used  by  the  AFEXTD  service,  which  creates  propositions 
(facts)  about  the  SN  based  on  patterns  of  annotated  instances  or  classes  from  the  text; 
therefore  constructing  the  social  web  that  ties  these  social  entities  together.  These  patterns  are 
called  the  text-based  templates  and  they  are  associated  with  a  proposition  template.  Each  time 
a  text-based  template  constraint  is  met  inside  a  document,  an  associated  proposition  (fact)  is 
created.  Details  regarding  automated  propositions  (facts)  extraction  from  unstructured  text 
documents  can  be  found  in  [Auger,  2009;  Martineau  and  Lecocq,  2013].  In  the  case  of  SN 
entities  extraction,  these  created  propositions  (facts)  have  predominantly  the  underlying 
format  of  a  triplet  (e.g.:  subject-predicate-object)  and  are  later  stored  inside  a  Neo4j  Graph 
database^. 

At  DRDC  Valcatier,  another  research  domain  focusing  on  multi-intelligence  automatic 
extraction,  storage  and  organization  under  a  Unified  Data  Space  (UDS)  is  considering  structured 
data  sources  pertinent  to  SNA  (point  "2b"  from  Figure  2). 

2.2  Data  Access  Services 

The  management  of  the  extracted  data,  unstructured  documents  and  knowledge  bases  under 
the  form  of  ontologies  is  done  by  the  prototype  through  data  access  services.  This  strategy 
enables  efficient  data  sharing  between  projects  using  a  unique  access  point.  Also,  since  the 


^  http://neo4j.org/ 
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extracted  data  inside  triplets  are  bind  to  ontologies,  a  single  access  point  prevents 
synchronization  issues.  These  services  are: 

•  the  Ontology  Repository  (OR); 

•  the  Document  Repository  (DR);  and 

•  the  Filter  Characterisation  (FiC). 

The  two  repository  services  mentioned  above  are  quite  straightforward.  Like  their  name  say 
they  provide  an  access  to  ontologies  and  documents  that  reside  on  the  ISTIP  platform.  They  are 
an  interface  to  a  more  complex  data  management  system.  The  data  can  be  accessed  by  File 
Transfers  Protocol  or  directly  by  the  file  system.  However,  the  services  offer  an  easier  access  for 
computer  system  as  well  as  notification  capability  when  new  data  come  in.  Since  entities  are 
added  and  SN  components  semantic  may  change  over  time,  ontologies,  in  which  this 
knowledge  is  stored,  must  be  obtained  through  the  OR  service.  This  service  is  used  by 
extraction  services  (SATD  and  AFEXTD)  to  keep  the  SN  up  to  date  and  by  the  filtering  service 
(FiC)  to  fetch  subsets  out  of  it. 

The  FiC  service  is  used  to  retrieve  SN  data  from  the  database.  The  SNA  prototype  currently  uses 
a  Neo4j  NoSQL  graph  database  but  it  could  be  replaced  by  other  products  or  services  without 
impacting  the  rest  of  the  system.  It  was  found  that  creation  of  precise  query  that  could  retrieve 
the  appropriate  data  to  answer  one's  question  could  be  a  tedious  task.  Therefore,  selecting  and 
extracting  a  subset  of  data  from  the  database  is  performed  through  the  FiC  service.  The  service 
simplifies  this  task  by  using  domain  ontologies  to  create  semantic  filters  that  generate  precise 
queries  applied  to  the  graph  database.  For  example,  an  analyst  may  ask  for  "kinship 
relationships"  to  the  FiC  service,  which  in  turn  exploits  the  ontology  to  identify  relations  like 
"brother  of",  "father  of",  "sister  of"  or  any  subclasses  of  the  one  of  interest.  The  filtering 
mechanics  is  detailed  in  Lecocq  et  al.  [2013]. 

2.3  Orchestration  and  Analysis  Services 

Performing  a  complete  analysis  for  an  analyst  usually  requires  more  than  one-step  algorithms 
in  order  to  make  sense  out  of  the  SN  and  ultimately,  of  the  situation.  In  SNA,  there  are  a  lot  of 
resources  to  perform  analysis  and  to  make  sense  out  of  it.  However,  they  are  all  uniquely 
characterized  by  the  technical/semantic  aspects  of  their  input  and  output  format.  So,  to  answer 
a  single  question  that  may  appear  quite  simple,  the  prototype  may  have  to  fetch  many  different 
networks,  use  different  algorithms  in  parallel  or  in  sequence  and  fuse  the  results.  An  important 
portion  of  the  complexity  resides  in  the  orchestration  of  the  analyses  i.e.  selecting  the  right 
data,  converting  it  to  the  appropriate  format,  calling  sub-analyses  in  a  meaningful  order,  and 
formatting  the  output.  To  handle  these  tasks,  the  SNA  prototype  uses  three  services: 

•  the  Network  Orchestrator  (NetOr); 

•  the  Network  Analyzer  (NetA);  and 

•  the  Network  Format  Conversion  (NeFoC). 
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The  NetA  service  is  responsible  of  carrying  analyses  on  data  using  many  different  resources.  It  is 
an  interface  that  exposes  analyses  capabilities  from  an  aggregation  of  libraries,  custom 
developed  analysis  and  commercial  off-the-shelf  products.  Among  those,  the  "R"  language^  is 
used  for  statistical  analysis  and  IGraph^  is  used  for  network  analysis.  Like  the  repository  services 
presented  above,  it  provides  a  single  access  point  for  data  analysis  that  can  be  called  using  a 
single  data  format.  However,  the  NetA  service  must  be  able  to  call  analyses  provider  using  the 
proper  format.  To  achieve  this  it  relies  on  the  NeFoC  services  which  only  purpose  is  to  convert 
data  from  one  format  to  the  other. 

The  NetOr  is  a  state-full  functionality  where  one  can  push  data,  perform  series  of  analyses  and 
get  notifications  when  they  are  completed.  Its  main  purpose  is  to  act  as  a  mean  to  ease  all  the 
different  stages  required  to  perform  analyses  of  social  networks  and  extract  intelligence  from 
them  to  support  sense-making.  Within  the  intelligence  community,  not  all  analysts  are  experts 
in  SNA;  such  functionality  could  help  them  leverage  the  value  of  SNA  for  intelligence  purposes. 
Indeed,  from  the  user  perspective,  the  functionality  will  result  in  the  need  to  select  a  topic  of 
interest  to  perform  the  analysis,  as  well  as  a  domain  and  some  corresponding  parameters  more 
specific  to  the  context  of  the  situation  of  interest  (as  for  instance  a  time  window  or  a 
geographic  area).  Based  on  these,  the  NetOr  will  identify  the  appropriate  algorithms  and 
associated  data  in  order  to  perform  analyses  of  the  social  networks.  This  schema  prevents 
potential  misuses  where  a  user  attempting  to  answer  a  specific  question  would  select 
inadequate  algorithms  and  data  leading  him/her  to  erroneous  conclusions  without  even 
noticing  it. 

2.4  Visualisation  of  the  analysis  results 

Once  the  analyses  performed  using  the  NetOr  and  NetA  services  the  analyst  can  visualise  the 
results  through  different  widgets  (Figure  2  point  "5")  and  more  specifically  the  Graph  Analyzer 
widget.  Being  the  core  topic  of  this  paper,  each  of  the  visualisation  widget  will  be  described  in 
the  following  section. 

3  Visualizing  to  Understand 

Since  the  onset  of  the  SNA  research  effort,  it  stood  out  that  visualisation  is  an  essential 
component  of  such  a  capability.  Similarly  than  considering  SNA  holistically  as  a  capability,  the 
importance  of  visualisation  also  goes  beyond  the  sole  element  of  exploring  the  analyses  results 
[Lavigne  et  al.,  2012].  For  instance,  visualisation  capacity  was  required  in  order  to  explore  the 
relation  between  the  issue  being  looked  up  and  the  related  SNA  results  (point  6  in  Figure  1).  By 
the  completion  of  the  research  investigation  of  the  SNA  methods  and  tools,  the  research  team 
will  have  included  most  of  the  different  components  of  the  SNA  capability  into  specific 
visualisation  widgets  or  portions  of  them. 


^  http://www.r-project.org/ 

^  http://igraph.sourceforge.net/ 
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Currently,  a  series  of  visualization  \A/idgets  (Figure  2  point  5)  was  designed  to  support  analyses 
of  social  networks.  This  series  gathers  generic  widgets  (meaning  easily  adaptable  to  different 
domains  as  for  instance  the  maritime  domain)  and  the  Graph  Analyzer  widget  that  is  entirely 
dedicated  to  supporting  visualization  of  SNA  results  as  for  instance  closeness  centrality.  The 
core  objective  of  the  visualisation  widgets  is  to  develop  a  high-level  understanding  of  the 
results  produced  by  the  analysis  and  to  externalize  this  understanding  in  explanatory  and 
tailored  views.  Every  generic  widget  aims  to  externalize  a  view  of  the  world  while  the  Graph 
Analyzer  focusses  on  externalizing  a  view  of  the  mind.  When  the  externalization  provides  a  view 
of  the  world,  data  and  information  representing  the  situation  of  interest  as  it  stands  (or  as  close 
as  it  can  be)  are  made  available  using  different  types  of  lenses  permitting  the  analysis  to 
increase  his/her  SA.  In  the  case  of  the  Graph  Analyzer  widget,  a  view  of  the  mind  is  presented 
since  this  view  is  a  result  of  certain  analyses  that  have  been  performed  and  therefore  providing 
an  increased  level  of  knowledge  about  the  situation.  Internal  (or  even  mental)  visualization  is  a 
means  of  instantiating  the  mental  model  corresponding  to  phenomenon  understanding,  which 
ones  are  the  results  of  specific  algorithms.  The  SNA  research  activities  seek  to  externalize  that 
model  through  a  set  of  capabilities  implemented  in  a  visualization  framework.  Externalize 
means  making  phenomenon  understanding  explicit  and  sharable.  In  fact,  the  SNA  related 
widgets  and  more  specifically  the  Graph  Analyzer  package  mental  models  of  understanding  in  a 
form  that  can  be  exported. 

First,  there  is  a  need  to  understand  visualization  as  a  means  to  achieve  effective  human 
communication  (e.g.  as  quality  printing  contributes  to  effective  distribution  of  text).  In  this 
context,  interactive  visualization^  is  of  great  value  in  order  to  understand  complex  phenomena 
as  in  the  case  of  analyzing  SN.  As  exposed  by  Nguyen  et  al.  [2010],  "interactive  visualization 
helps  the  human  analyst  to  gain  knowledge  of  the  data  through  our  powerful  human  visual 
perception  and  reasoning  skills,  ideally  driving  the  system  toward  more  focused  and  more 
adequate  analytical  techniques".  Visualization  is  exploited  as  a  support  to  an  exploration 
process  (generic  widgets)  and  as  a  vehicle  for  (explicit)  representation  (Graph  Analyzer). 
Visualization  is  considered  in  several  occasions  in  the  current  SNA  research  activities  and  it 
must  strongly  adhere  to  usability  principles  that  are  essential  for  human  -  machine  synergy.  But 
its  two  modes  call  for  somewhat  different  usability  emphasis,  i.e.  the  generic  widgets  promote 
exploration  as  a  highly  dynamic  activity  (because  rapid  interactivity  is  key);  and  the  Graph 
Analyzer  widget  relates  to  higher  abstraction  levels  (e.g.  navigating  among  various  knowledge 
domains,  tracking  through  asserted  linkages,  new  perspectives  on  the  network  based  on 
applied  SNA  measures).  Every  widget  does  not  work  on  the  final  visualization  of  the 
understanding  representation  but  conducts  to  its  building  by  the  analyst.  The  objective  always 
remains  to  provide  the  analyst  with  a  series  of  tools  and  perspectives  in  order  to  leverage  its 
expertise  rather  than  attempting  to  over  automate  some  analytical  aspects. 


4 

Interactive  visualization  “is  a  process  made  up  of  a  number  of  interlocking  feedback  loops  that  fall  into  three  broad  classes.  At 
the  lowest  level  is  the  data  manipulation  loop,  through  which  objects  are  selected  and  moved  using  the  basic  skills  of  eye-hand 
coordination.  [. . .]  At  an  intermediate  level  is  an  exploration  and  navigation  loop,  through  which  an  analyst  finds  his  or  her  way 
in  a  large  visual  data  space.  [. . .]  At  the  highest  level  is  a  problem  solving  loop  through  which  the  analyst  forms  hypotheses 
about  the  data  and  refines  them  through  an  augmented  visualization  process.  [Ware,  2004] 
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By  definition,  visualization  is  "the  act  or  process  of  interpreting  in  visual  terms  or  of  putting  into 
visible  form"^.  Data  visualization  is  simply  the  study  of  the  visual  representation  of  data.  In 
other  words,  a  visualization  view  -  or  view  or  visualization  -  is  defined  as  a  graphical 
representation  of  concepts  or  data,  which  is  either  an  internal  construct  of  the  mind  or  an 
external  artifact  supporting  decision  making  and/or  action.  Visualization  views  may  range  from 
simple  to  complex,  but  no  matter  the  level  of  complexity  and  the  type  of  data,  a  visualization 
view  is  intended  to  help  interpret  data  in  a  meaningful  way.  Data  can  be  defined  as  the  raw 
facts,  and  doesn't  really  have  a  meaning  at  all  on  its  own.  When  data  has  been  processed,  data 
become  information  which  has  a  valuable  meaning  for  human  who  visualizes  it.  And  knowledge 
corresponds  to  a  transformation  of  information  triggering  people  to  decide  and  act.  The 
presentation  of  the  relationships  among  data,  information,  and  knowledge  in  a  hierarchical 
arrangement  has  been  part  of  the  language  of  information  science  for  many  years  [Ackoff, 
1989]^.  Visualization  domain  was  historically  categorized  into  two  major  areas:  information 
visualization  and  scientific  visualization.  Data  visualization  is  a  slightly  narrower  domain  and 
just  an  umbrella  expression  under  which  the  different  categories  can  be  gathered.  Information 
visualization  (visual  data  analysis)  "is  the  study  of  (interactive)  visual  representations  of  abstract 
data^  to  reinforce  human  cognition.  [...]  However,  information  visualization  differs  from 
scientific  visualization:  "it's  infovis  [information  visualization]  when  the  spatial  representation  is 
chosen,  and  it's  scivis  [scientific  visualization]  when  the  spatial  representation  is  given" 
[Munzner,  2008].  Information  visualization  is  the  most  reliant  on  the  cognitive  skills  of  human 
analysts,  and  allows  the  discovery  of  unstructured  actionable  insights  that  are  limited  only  by 
human  imagination  and  creativity.  The  analyst  does  not  have  to  learn  any  sophisticated 
methods  to  be  able  to  interpret  the  visualizations  of  the  data.  Information  visualization  should 
be  considered  as  a  discovery  tool  enabling  the  analyst  to  form  a  hypothesis  about  the  situation 
at  hand.  The  SNA  prototype  should  then  help  the  analyst  to  test  such  hypothesis  through 
additional  analytical  of  visual  analytics  functions  as  for  instance  the  distribution  of  certain 
characteristics  within  a  specific  network  of  interest.  Scientific  visualization  as  appraised  by 
Friendly  [2004],  "is  primarily  concerned  with  the  visualization  of  3-D+  phenomena, 
(architectural,  meteorological,  medical,  biological,  etc.),  where  the  emphasis  is  on  realistic 
renderings  of  volumes,  surfaces,  illumination  sources,  and  so  forth,  perhaps  with  a  dynamic 
(time)  component".  In  our  context,  the  purpose  of  scientific  visualization  is  therefore  to  provide 
graphics  depicting  scientific  data  about  a  situation.  These  data  should  be  easily  understood  by 
the  analysts,  create  insight  and  increase  their  SA. 

3.1  Cognitive  Overload  and  Insight 

Data  overload  can  be  defined  as  "a  condition  where  a  practitioner,  supported  by  artifacts  and 
other  practitioners  finds  it  extremely  challenging  to  focus  in  on,  assemble,  and  synthesize  the 
significant  subset  of  data  for  the  problem  context  into  a  coherent  situation  assessment,  where 


^  http://www.merriam-webster.com/dictionary/visualization 

^  Note  that  such  a  perspective  has  also  been  many  time  reconsidered  [Murray,  2009]. 

^  The  abstract  data  include  both  numerical  and  non-numerical  data,  such  as  text  and  geographic  information. 
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the  subset  is  a  small  portion  of  a  vast  data  field"  [Patterson  et  al.,  2001].  We  can  easily  agree 
that  dealing  with  large  graphs  of  SN  as  well  as  their  relation  to  other  networks  can  indeed  result 
in  data  overload.  On  the  other  hand,  we  expect  that  the  insight  gained  from  this  analysis  is 
worth  the  effort.  Insight  is  "thought  to  arise  when  a  solver  breaks  free  of  unwarranted 
assumptions,  or  forms  novel,  task-related  connections  between  existing  concepts  or  skills" 
[Bowden  et  al.,  2005].  A  highly  promising  approach  of  mixing  appropriate  computational 
methods  with  cleverly  designed  visualizations  is  expected  to  maximize  the  insight  benefits  while 
keeping  the  cognitive  overload  at  the  lowest  possible  level. 

3.2  Visualization  Requirements 

The  general  visualization  requirements  for  the  intended  SNA  capability  cover  all  the  steps  of  the 
analysis  process,  as  exposed  in  Figure  1,  and  are  ranging  from  defining  the  objectives  of  the 
analysis  all  the  way  down  to  the  SNA  products  usability  [Lecocq  et  al.,  2011].  We  further  refined 
the  requirements  related  to  the  analysis  step  and  mapped  them  to  a  taxonomy  of  visualization 
methods  [Lavigne  et  al.,  2012].  This  Visual  Thinking  Codex  [Roam,  2008]  is  a  simple  but 
powerful  taxonomy  that  divides  a  problem  into  six  slices  (the  rows  of  the  matrix),  in  order  to 
depict  the  problem  in  the  best  visual  way  when  thinking  or  sharing  thoughts.  The  six  slices  are: 

1.  Who  and  What  problems.  Challenges  that  relate  to  things,  people,  and  roles; 

2.  How  much  problems.  Challenges  that  involve  measuring  and  counting; 

3.  When  problems.  Challenges  that  relate  to  scheduling  and  timing; 

4.  Where  problems.  Challenges  that  relate  to  direction  and  how  things  fit  together; 

5.  How  problems.  Challenges  that  relate  to  how  things  influence  one  another;  and 

6.  Why  problems.  Challenges  that  relate  to  seeing  the  big  picture. 

The  Codex  is  then  used  to  further  characterize  the  problem  in  order  to  focus  the  analysis  and 
the  visual  information  sharing,  according  to  five  SQVID  questions  (the  columns  of  the  matrix): 

•  S.  Simple  or  Elaborate; 

•  Q.  Quality  vs.  Quantity; 

•  V.  Vision  vs.  Execution; 

•  I.  Individual  attributes  vs.  Comparison;  and 

•  D.  Delta  (or  Change)  vs.  Status  quo. 

To  meet  some  of  the  other  visualization  and  analysis  requirements  related  to  our  SNA  research 
activities,  a  series  of  visualization  widgets  were  identified;  each  widget  addresses  a  slice.  Figure 
3  shows  each  slice  and  the  associated  widgets.  The  Graph  Analyzer  is  the  most  encompassing 
widget  and  the  center  of  the  SNA  visualization  capability. 
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Figure  3  -  Visualization  widgets  in  relation  to  the  Roam's  Visual  Thinking  Codex  (modified  from 

[Roam,  2008]) 


3.3  User  Interface  Description  -  Adapting  Generic  Widgets  for  SNA 

As  part  of  our  research  process,  we  designed  four  generic  widgets  that  could  enhance  analysis 
for  multiple  application  domains  [Lavigne  et  al.,  2011].  We  implemented  a  first  version  of  these 
widgets  in  the  Maritime  Visual  Analytics  Prototype  [Lavigne,  2014].  SNA  versions  of  these 
widgets  were  envisaged  early  in  our  process  [Lavigne  et  al,  2012].  However,  applying  these 
fairly  generic  tools  to  a  dataset  from  an  entirely  different  domain  required  a  few  adaptations 
and  enhancements  to  provide  a  more  meaningful  visual  experience.  Figure  4  shows  the 
resulting  adapted  widgets  for  SNA. 
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Figure  4  -  Generic  visuaiization  widgets  adapted  for  SNA^ 


^  The  prototype  has  been  tested  using  an  enhaneed  version  of  the  “Ali  Baba”  data  set  initially  ereated  in  2003  for  the  National 
Seeurity  Ageney  (NSA)  by  Mark  Jaworowski  and  Steve  Pavlak  [Jaworowski,  2003].  This  version  of  the  dataset  has  been 
enhaneed  by  the  Army  Researeh  Laboratory  as  well  as,  later  on,  by  DRDC  with  additional  data  required  to  enable  some  of  the 
SNA  use-eases. 
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3.3.1  Analysis  Set  Manager 


The  Analysis  Set  Manager  serves  as  the  visual  repository  for  the  analyzed  data  and  is  the 
starting  point  of  the  visualization  capability.  This  \A/idget  groups  information  elements  together 
into  "analysis  sets"  displayed  in  a  hierarchical  structure.  Any  set  can  then  be  selected  and  sent 
to  another  visualization  \A/idget  for  further  analysis.  Based  on  manipulation  of  the  sets 
performed  in  other  widgets,  new  data  sets  can  be  created.  These  refined  data  sets  can  be 
defined  following  the  intelligent  analyst's  needs  helping  him  to  progress  with  respect  to 
pending  intelligence  gaps.  In  the  specific  case  of  SNA,  sets  are  comprised  of  networks  nodes 
and  links  along  with  computed  social  metrics  data. 

3.3.2  Visual  Summary  Cards  and  Record  Browser 

The  Visual  Summary  Cards  are  meant  to  display  all  the  relevant  characteristics  of  an  entity 
visually  using  images  and  icons  to  represent  the  information,  so  that  they  can  be  parsed  very 
quickly.  The  Record  Browser  lets  the  user  flip  those  cards  rapidly.  The  user  can  also  drag  a  card 
to  the  left  part  of  the  widget  for  rapid  visual  comparison  between  cards.  The  backside  of  the 
cards  contains  all  the  relevant  textual  details  for  deeper  analysis.  Although  the  concept  is 
generic,  this  widget  requires  a  careful  design  of  the  cards  content  that  must  be  tailored  to  each 
application  domain.  For  the  SNA  prototype,  the  cards  depict  nodes  of  the  SN  (persons, 
organizations  or  groups).  Information  related  to  the  node  identity  and  characteristics  are 
included  such  as  the  name,  nationality,  known  allegiance,  last  report  where  the  individual  was 
mentioned.  Other  data  of  the  card  provide  network  related  metrics,  a  snapshot  of  their  ego 
network  and  a  geographical  display  of  their  associated  current  and  past  locations.  The  ego 
network  can  be  dynamically  changed  to  reflect  the  types  of  links  the  individual  is  involved  in. 

3.3.3  Magnets  Grid 

The  Magnets  Grid  allows  the  simultaneous  exploration  of  multiple  dimensions  of  information. 
Any  characteristic  of  the  set  entities  can  be  placed  on  the  canvas  as  a  magnet.  The  nodes 
forming  the  set  are  depicted  as  "dust"  dots  that  react  to  the  magnets  present.  When  the  shake 
button  is  pressed,  the  dots  move  towards  the  magnets  at  a  speed  proportional  to  the  attribute 
attraction  strength.  The  nodes  attributes  can  also  be  associated  to  the  node  size  or  color.  They 
can  even  be  selected  as  axes,  creating  rows  and/or  columns  that  constrain  the  dust 
movements.  This  is  one  of  the  easiest  widget  to  adapt  for  reuse  since  the  attributes  and 
characteristics  are  automatically  provided  in  the  widget  based  on  the  data  set.  The  SNA 
prototype  made  a  direct  reuse  of  this  widget  for  its  own  benefits.  The  calculated  network 
measures  can  be  used  as  a  characteristic  attracting  the  nodes,  which  are  the  dots. 

3.3.4  Multi-Timelines 

The  Multi-Timelines  display  temporal  events  related  to  entities  on  separate  rows.  The  timelines 
can  be  desynchronized,  allowing  the  visual  comparison  of  events  that  happened  during 
different  time  periods.  The  timeline  related  to  a  particular  entity  can  be  duplicated  on  other 
rows,  allowing  self-comparison  to  detect  patterns  related  to  previous  occurrences.  This  widget 
displays  the  temporal  events  associated  with  the  selected  network  nodes.  For  the  SNA 
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prototype,  events  can  be  anything  with  a  timestamp  as  for  instance  meetings,  communications, 
or  else  reports  where  the  node  was  mentioned.  Using  the  mouse  over  more  details  is  provided 
with  respect  to  the  event. 

3.3.5  Animated  Map  and  Timeline 

With  the  Animated  Map  and  Timeline,  one  can  select  a  geographical  area  and  a  time  period  for 
the  display.  Dragging  the  selected  time  period  along  the  timeline  area  below  the  map  produces 
a  smooth  animation  of  the  entities  displayed  on  the  map.  This  widget  can  support  the  Graph 
Analyzer  by  showing  how  the  geographical  locations  associated  with  node  change  in  time. 
When  desired,  only  some  specific  nodes  and  their  tracks  can  be  selected  and  highlighted  in 
order  to  provide  a  more  accurate  time  display  to  the  end-user. 

3.4  Graph  Analyzer  Widget 

Unlike  the  four  widgets  from  the  left  part  of  Figure  3,  the  Graph  Analyzer  widget  is  entirely 
dedicated  to  SNA.  This  widget  exhibits  nodes/entities  (e.g.  persons  or  groups)  and  (directional) 
links/relations  (e.g.  affiliation  type  and  influential  type).  In  terms  of  representation,  it  is  inspired 
from  the  focus  node  technique  involving  that  the  rest  of  the  nodes  are  presented  around  it.  The 
node  of  interest  can  be  re-position  upon  the  analyst  instigation,  in  that  case,  it  will  move 
toward  the  left  upper  side  of  the  display  having  the  related  nodes  organized  based  on  the 
depth  of  their  connection  to  it.  Existing  link  types  are  analyzed  and  a  legend  is 
created/displayed  allowing  users  to  filter  specific  relations  under  the  "Links"  tab.  The  Graph 
Analyzer  widget  has  also  to  support  analyses  leading  to  identify  social  similarity,  complicity, 
allegiances  between  nodes/entities  as  well  as  how  these  nodes  topologically  behave  with 
respect  to  the  network.  Therefore,  supplementary  analysis  results,  under  the  "Analysis"  tab,  are 
inserted  in  the  display  at  will.  These  results  based  on  the  SNA  are  displayed  using  dotted  lines  in 
the  widget.  Figure  5  shows  for  the  two  first  layouts,  a  display  of  the  network  relations  from  the 
"Links"  tab,  followed  by  one  layout  displaying  calculated  SNA  measures  under  the  "Analysis" 
tab. 
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Figure  5  -  Graph  Analyzer  widget:  first  version 


17 


4  Conclusion  and  Future  Researches 


During  the  last  few  years,  DRDC  has  investigated  SNA  methods  and  techniques  by  means  of  a 
proof-of-concept  prototype  development.  The  first  year  was  dedicated  to  activities  meant  to 
understand  the  military  requirements  for  SNA  methods  and  tools  as  well  as  to  analyse  currently 
available  ones  on  the  market.  The  output  emphasized  the  following  need  among  others: 

•  a  SNA  capability,  as  exposed  previously,  rather  than  an  analysis  tool  solely; 

•  a  SNA  capability  that  is  considered  to  be  one  of  the  several  analyses  required  to  be 
performed  by  the  analyst  for  a  specific  issue; 

•  methods  and  techniques  that  are  generic  and  applicable  to  other  contexts  than  COIN; 
and 

•  tools  that  are  easy  to  use  and  to  understand  even  by  individuals  who  are  experts  in  their 
domain  but  not  necessarily  with  respect  to  SNA  per  se. 

Based  on  the  above,  the  SNA  proof-of-concept  prototype  first  intended  to  develop  the  generic 
SNA  supporting  services  in  accordance  to  SOA  principles.  This  permitted  to  develop  a  network 
analysis  prototype  rather  than  a  specific  "SOCIAL"  network  analysis  capability.  In  the  future,  the 
same  services  could  be  used  to  analyse  other  networks  like  cyber  networks  for  instance.  Very 
rapidly,  the  project  started  to  leverage  visualization  and  visual  analytics  techniques  to  carry  the 
value  of  the  social  networks  analyses  results  to  the  intelligence  analyst. 

In  the  context  of  SNA,  much  remain  to  be  performed  in  this  area.  Indeed,  only  some  of  the 
visualisation  requirements  identified  in  Lecocq  et  al.  [2011]  were  actually  instantiated  at  this 
point,  as  for  instance  the  link  views  requirement. 

The  coming  research  activities  will  focus  on  instantiating  the  remaining  requirements,  running 
the  use-cases  with  real  data  and  modifying  the  prototype  based  on  the  results,  adapting  more 
closely  the  visual  analytic  components  to  the  military  context,  investigating  real  value  of 
immersive  visualization  environment  in  the  context  of  SNA,  transposing  the  proof-of-concept 
prototype  to  different  network  analysis  contexts,  integrating  some  of  our  reasoning  services  to 
enhance  the  analysis  results. 
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